Heap Out-of-Bounds Write Vulnerability in GStreamer by Red Hat
CVE-2026-19387

7.6HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 10 August 2026

What is CVE-2026-19387?

A heap out-of-bounds write vulnerability was identified in the GStreamer gst-plugins-bad adpcmdec element during the decoding process of IMA/DVI ADPCM audio. This security flaw stems from insufficient validation of the per-block sample count, particularly for multi-channel streams. An attacker could exploit this by delivering a specially crafted WAV file, leading to writes that exceed the bounds of the allocated output buffer. The potential consequences include application crashes, denial of service incidents, memory corruption, and in certain cases, arbitrary code execution when processing untrusted media.